agenttesla | 2764-10-0x0000000000400000-0x0000000000440000-memory[.]dmp | Triage

Sharing

General

Target

2764-10-0x0000000000400000-0x0000000000440000-memory.dmp
Size

256KB
MD5

76dc5b448f8283085af352560923ebdd
SHA1

4c3ee028b64d3dbb5fdf2d8da7ab9c77e61690a0
SHA256

b40ab298a63e584d78274dc30a4128bef56a066f29d9e30de7b1433387139a47
SHA512

a69727dbbb85cfdd3ab7bcd056770a95da1bd659f18b798f9785150d12f987384eea0ba01efd66a20a342995c7cbaf7197e3e2063d00d707b1f80fe47b52c397
SSDEEP

3072:MQmos4Ufb52b2Z87bBHrZh42DzfGJ659G7NA:Dmos4Ufb52by87bBjvfGJz72

Score

10^/10

agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.cesky-hosting.cz
Port:
587
Username:
[email protected]
Password:
Luk7816&
Email To:
[email protected]

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2764-10-0x0000000000400000-0x0000000000440000-memory.dmp

Files

2764-10-0x0000000000400000-0x0000000000440000-memory.dmp
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 232KB - Virtual size: 231KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ